VM: Flaky crash in VisitPointersPredefined on co19_2/Language/Classes/method_definition_t10

[alexmarkov]

Can be reproduced on mac:

tools/build.py -m release -a x64 runtime
tools/test.py -n dartk-mac-release-x64 --repeat 1000 co19_2/Language/Classes/method_definition_t10

  DART_CONFIGURATION=ReleaseX64 xcodebuild/ReleaseX64/dart --ignore-unrecognized-flags --packages=/b/s/w/ir/.packages /b/s/w/ir/tests/co19_2/src/Language/Classes/method_definition_t10.dart
  exit code:
  -6
  stderr:
  Class Id: 0
  ../../runtime/vm/raw_object.cc: 322: error: unreachable code
  version=2.5.0-edge.d0cb753ebdb350c30158cfb526c0bbdf5257c144 (Mon Jul 15 17:09:06 2019 +0000) on "macos_x64"
  thread=5635, isolate=main(0x7ffcf7017e00)
    pc 0x000000010c25e944 fp 0x0000700001f8cbd0 dart::Profiler::DumpStackTrace(void*)
    pc 0x000000010bf583d2 fp 0x0000700001f8ccb0 dart::Assert::Fail(char const*, ...)
    pc 0x000000010c274d0e fp 0x0000700001f8cd00 dart::RawObject::VisitPointersPredefined(dart::ObjectPointerVisitor*, long)
    pc 0x000000010c4a1c9f fp 0x0000700001f8cd30 dart::Scavenger::VisitObjectPointers(dart::ObjectPointerVisitor*) const
    pc 0x000000010c497e4a fp 0x0000700001f8cdc0 dart::GCMarker::IterateRoots(dart::ObjectPointerVisitor*)
    pc 0x000000010c499fad fp 0x0000700001f8ce50 dart::ParallelMarkTask::Run()
    pc 0x000000010c2fcebf fp 0x0000700001f8ce80 dart::ThreadPool::Worker::Loop()
    pc 0x000000010c2fcd62 fp 0x0000700001f8cec0 dart::ThreadPool::Worker::Main(unsigned long)
    pc 0x000000010c25ae8f fp 0x0000700001f8cef0 dart::ThreadStart(void*)
    pc 0x00007fff5c459661 fp 0x0000700001f8cf20 _pthread_body
    pc 0x00007fff5c45950d fp 0x0000700001f8cf50 _pthread_body
    pc 0x00007fff5c458bf9 fp 0x0000700001f8cf78 thread_start
  -- End of DumpStackTrace
  --- Re-run this test:
  python tools/test.py -n dartk-mac-release-x64 co19_2/Language/Classes/method_definition_t10

Appeared 2 times per 1000 iterations.

/cc @rmacnak-google @mkustermann

[alexmarkov]

This can be also reproduced on Linux.

[rmacnak-google]

Using rr with watchpoints, I see that the header was overridden by a bad offset in a StoreInstanceField instruction

file:///usr/local/google/home/rmacnak/dart1/sdk/tests/co19_2/src/Language/Classes/method_def\
inition_t10.dart_A_A.
...
        ;; GuardFieldLength:14(_x@19443451 <?>, t2)
0x7f023932cbee    58                     pop rax
0x7f023932cbef    498b4f1f               movq rcx,[pp+0x1f]   Field <A._x@19443451>: final
0x7f023932cbf3    480fbe515f             movsxbq rdx,[rcx+0x5f]
0x7f023932cbf8    488b5937               movq rbx,[rcx+0x37]
0x7f023932cbfc    4883fa00               cmpq rdx,0
0x7f023932cc00    0f8824000000           js 0x00007f023932cc2a
0x7f023932cc06    483b1c10               cmpq rbx,[rax+rdx*1]
0x7f023932cc0a    0f841a000000           jz 0x00007f023932cc2a
0x7f023932cc10    51                     push rcx
0x7f023932cc11    50                     push rax
0x7f023932cc12    498b9e80030000         movq rbx,[thr+0x380]
0x7f023932cc19    41ba02000000           movl r10,2
0x7f023932cc1f    41ff9680010000         call [thr+0x180]
0x7f023932cc26    415b                   pop r11
0x7f023932cc28    415b                   pop r11
        ;; StoreInstanceField(t0 . _x@19443451 = t1, barrier removed)
0x7f023932cc2a    415b                   pop r11
0x7f023932cc2c    58                     pop rax
0x7f023932cc2d    48c740ff00000000       movq [rax-0x1],0    <<<<<<<<<< stores to header instead of first field